Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 23:51
Behavioral task
behavioral1
Sample
31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
-
Target
31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll
-
Size
4.3MB
-
MD5
31acaab0dc1ff13752b6692e006a0849
-
SHA1
ae2675af4abf0138f8ed8cdcea81762d9e4704bb
-
SHA256
7b9234facc1db74bf568ff74e86c888c0dd10915d99b621e6a902b5bbaa5d1c2
-
SHA512
4014813ab88f0b36794aa903ad67416e5acd27510928768920b7a1089cd6964a2c1b4e1dab42e4c30184fd93bd1c8282e0cfb40976fc32b644032ad168e606d6
-
SSDEEP
98304:71x/5hJzli4E6a4TFE2kr/tRZl8Nu8D0nup:/1I4E6bTufZld8DCu
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2096-5-0x0000000073C30000-0x000000007409A000-memory.dmp vmprotect behavioral1/memory/2096-7-0x0000000073C30000-0x000000007409A000-memory.dmp vmprotect behavioral1/memory/2096-8-0x0000000073C30000-0x000000007409A000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2096 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2096 2108 rundll32.exe 29 PID 2108 wrote to memory of 2096 2108 rundll32.exe 29 PID 2108 wrote to memory of 2096 2108 rundll32.exe 29 PID 2108 wrote to memory of 2096 2108 rundll32.exe 29 PID 2108 wrote to memory of 2096 2108 rundll32.exe 29 PID 2108 wrote to memory of 2096 2108 rundll32.exe 29 PID 2108 wrote to memory of 2096 2108 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2096
-